fix: restore reusable workflow references

[NWarila]

Summary

• Repoint reusable workflow calls to commits reachable from target repository branches.
• Move runner-template and framework references in lockstep, synchronize the security baseline, and grant the deploy caller permission to maintain drift issues.
• Correct the framework-dependent forking note and remove a stale release header reference.

Behavior and risk

• Auto-merge now trusts Renovate only; Dependabot pull requests are no longer auto-merged.
• The framework update defaults public repository forking to enabled, defaults vulnerability alerts to disabled, leaves repository web commit signoff unmanaged, removes Dependabot security updates from management, and defaults verified Marketplace actions to disallowed. The public security baseline still enables supported free security features before the disabled fallback is considered.
• Org ADR synchronization can load, but its write path remains unavailable because this repository has no sync token.

Validation

• actionlint reports zero errors across all eight tracked workflows.
• The repository-pinned yamllint and markdownlint checks pass.
• All called workflows exist at heads/tags-reachable commits, and caller inputs, secrets, and effective permissions match their call contracts.

Deployment boundary

No terraform/** path changed, so the deployment workflow is not triggered. Pull-request validation runs fixture-backed terraform test plan-mode tests; no live Terraform plan or apply is performed, and the four private S3 inventory files are not read.